Published on February 27, 2014
SYMANTEC INTELLIGENCE REPORT JANUARY 2014
p. 2 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 CONTENTS CONTENTS 3 Executive Summary 4 BIG NUMBERS 7 TARGETED ATTACKS 8 Targeted Attacks 8 Targeted Attacks per Day 8 First Attacks Logged by Month 9 Attacks by Size of Targeted Organization 9 Top 10 Industries Attacked 9 First Attacks Logged by Size 9 File Extensions of Attachments 10 Social Media 11 Social Media 11 Top 5 Social Media Attacks 12 DATA BREACHES 13 Data Breaches 13 Top 5 Types of Information Exposed 13 Twelve-Month Timeline of Data Breaches 14 MOBILE 19 SPAM, PHISHING, & MALWARE 20 Spam 20 Top 5 Activity for Spam Destination by Geography 20 Top 5 Activity for Spam Destination by Industry 21 Top 10 Sources of Spam 21 Average Spam Message Size 21 Top 5 Activity for Spam Destination by Company Size 21 Spam by Category 21 Spam URL Distribution Based on Top Level Domain Name 22 Phishing 22 Top 10 Sources of Phishing 22 Top 5 Activity for Phishing Destination by Company Size 22 Top 5 Activity for Phishing Destination by Industry 22 Top 5 Activity for Phishing Destination by Geography 23 Phishing Distribution 23 Organizations Spoofed in Phishing Attacks 24 Malware 24 Proportion of Email Traffic in Which Virus Was Detected 24 Top 10 Email Virus Sources 25 Top 5 Activity for Malware Destination by Industry 25 Top 5 Activity for Malware Destination by Geographic Location 25 Top 5 Activity for Malware Destination by Company Size 26 Endpoint Security 26 Top 10 Most Frequently Blocked Malware 15 Mobile 15 Mobile Malware by Type 16 Cumulative Mobile Android Malware 27 Policy Based Filtering 27 Policy Based Filtering 17 VULNERABILITIES 28 More Information 18 Vulnerabilities 18 Total Vulnerabilities Disclosed by Month 18 Browser Vulnerabilities 18 Plug-in Vulnerabilities 28 About Symantec
p. 3 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Executive Summary Welcome to the January edition of the Symantec Intelligence report. Symantec Intelligence aims to provide the latest analysis of cyber security threats, trends, and insights concerning malware, spam, and other potentially harmful business risks. A number of large data breaches were reported during the month of January. The largest new data breach included the exposure of 105.8 million identities in South Korea. (It’s worth noting that many individuals in the country had more than one account exposed in this breach.) Another large data breach, previously reported as including 40 million identities, has since had its numbers adjusted upwards and is now estimated at 110 million identities exposed. These two breaches contribute significantly in bringing the total number of identities exposed to over 500 million for the last twelve months. Targeted attacks are up to their highest level since August of last year, after what appears to be average-to-low attack numbers over the last four months. Manufacturing is the most targeted industry, making up 21.3 percent of attacks. The non-traditional services category, which includes hospitality, recreation, and repair, is a close second at 20.6 percent. The number of vulnerabilities reported is also up in January after lower numbers reported in November and December of last year. However, at 555 vulnerabilities, this number is still well below October, which reported a high of 663 for the month. In other news, spam and phishing rates are down slightly in January, while email virus rates are at their lowest levels since October of last year. We hope that you enjoy this month’s report and feel free to contact us with any comments or feedback. Ben Nahorney, Cyber Security Threat Analyst firstname.lastname@example.org
p. 4 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 BIG NUMBERS
p. 5 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Estimated Global Email Spam Rate Per Day Overall Email Phishing Rate: HIGHER NUMBER = LOWER RISK SPAM AS PERCENT OF ALL EMAIL Nov Dec Jan 1 in 1,311 1 in 1,053 1 in 1,444 100 90 80 70 60 62% 64% 62% 50 40 Overall Email Virus Rate: 30 20 10 HIGHER NUMBER = LOWER RISK 1 in 253 1 in 164 Nov Dec Jan 1 in 431 0 Nov Dec Jan New Vulnerabilities Nov Mobile Vulnerabilities Nov Dec Jan 6 1 2 Dec Jan 438 471 555
p. 6 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Mobile Malware Variants 10000 VARIANTS (CUMULATIVE) 9000 7,751 8000 7000 6000 186 5000 4000 3000 132 139 Dec Jan 2000 1000 0 J F M A M J J A S O N D J Nov Data Breaches Number of Breaches (12 month period) 219 Number of Identities Exposed (12 month period) 501,516,310
p. 7 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 TARGETED ATTACKS
p. 8 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Targeted Attacks At a Glance Targeted Attacks per Day Source: Symantec • Targeted attacks were up in January, reaching their highest levels since August of 2013. • The .exe file type was the most common attachment, making up 24.7% of email-based targeted attacks that included file attachments. 225 200 TARGETED ATTACKS • Small companies of 250 employees or less were targeted in 39% of attacks, though organizations with 2500+ employees were targeted more often, based on first attacks. 250 175 150 125 100 75 50 25 JAN FEB MAR APR MAY JUN JUL AUG SEP OCT 2012 NOV DEC 2013 2014 First Attacks Logged by Month Source: Symantec 1200 1100 1000 900 800 700 600 500 400 300 200 100 F M A M J J A S O N D J 2014
p. 9 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Attacks by Size of Targeted Organization First Attacks Logged by Size Source: Symantec Source: Symantec Company Size Percent Company Size Percent 1-250 38.9% 1-250 29.2% 251-500 9.1% 251-500 8.5% 501-1000 5.8% 501-1000 9.6% 1001-1500 3.4% 1001-1500 6.0% 1501-2500 4.8% 1501-2500 7.5% 2500+ 37.9% 2500+ 39.1% Top 10 Industries Attacked File Extensions of Attachments Source: Symantec Source: Symantec Industry Percent File Extension Percent Manufacturing 21.3% .exe 24.7% Services - Non Traditional 20.6% .doc 11.1% Finance, insurance & Real Estate 13.7% .scr 8.4% .au3 7.5% Services - Professional 11.4% .jpg 6.2% .pdf 1.9% Wholesale 11.0% Transportation, communications, electric, gas & Sanitary Services 5.9% .dat 1.5% Public Administration 4.2% .com 0.4% Retail 3.2% .rtf 0.4% Construction 2.2% .zip 0.3% Mining 1.5% The “Professional” services category includes services such as Legal, Accounting, Health, and Education. “Non-Traditional” services include Hospitality, Recreational, and Repair services.
p. 10 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 SOCIAL MEDIA
p. 11 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Social Media At a Glance Top 5 Social Media Attacks Source: Symantec • 82 percent of all social media attacks in January where fake offerings. • Likejacking is the secondmost common type of social media attack at 8 percent. Top 5 Social Media Attacks 82% Fake Offering 8% Likejacking 5% Manual Sharing 2% Fake Apps 2% Comment Jacking Methodology Fake Offering. These scams invite social network users to join a fake event or group with incentives such as free gift cards. Joining often requires the user to share credentials with the attacker or send a text to a premium rate number. Fake Plug-in Scams. Users are tricked into downloading fake browser extensions on their machines. Rogue browser extensions can pose like legitimate extensions but when installed can steal sensitive information from the infected machine. Likejacking. Using fake “Like” buttons, attackers trick users into clicking website buttons that install malware and may post updates on a user’s newsfeed, spreading the attack. Fake Apps. Applications provided by attackers that appear to be legitimate apps; however, they contain a malicious payload. The attackers often take legitimate apps, bundle malware with them, and then re-release it as a free version of the app. Manual Sharing Scams. These rely on victims to actually do the hard work of sharing the scam by presenting them with intriguing videos, fake offers or messages that they share with their friends.
p. 12 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 DATA BREACHES
p. 13 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Data Breaches Twelve-Month Timeline of Data Breaches At a Glance Source: Symantec 160 IDENTITIES BREACHED (MILLIONS) • In the last 12 months, more than 500 million identities have been exposed. 45 40 140 35 120 30 100 25 80 20 60 15 40 10 20 • The reported number of identities exposed in a late-November data breach has since been adjusted upward. This breach is now estimated to have exposed 110 million identities. 180 5 NUMBER OF INCIDENTS • The largest data breach that was reported in January resulted in the exposure of 105.8 million identities. 0 0 F M A M J J A S O N IDENTITIES BREACHED D J 2014 INCIDENTS Top 5 Types of Information Exposed Source: Symantec Information Exposed in Breaches % OF ALL BREACHES Real Names 70% Gov ID numbers (Soc Sec) 39% Birth Dates 39% Home Address 37% Medical Records 31% Methodology This data is procured from the Norton Cybercrime Index (CCI). The Norton CCI is a statistical model that measures the levels of threats, including malicious software, fraud, identity theft, spam, phishing, and social engineering daily. The data breach section of the Norton CCI is derived from data breaches that have been reported by legitimate media sources and have exposed personal information. In some cases a data breach is not publicly reported during the same month the incident occurred, or an adjustment is made in the number of identities reportedly exposed. In these cases, the data in the Norton CCI is updated. This causes fluctuations in the numbers reported for previous months when a new report is released. Norton Cybercrime Index http://us.norton.com/protect-yourself
p. 14 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 MOBILE
p. 15 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Mobile At a Glance Mobile Malware by Type Source: Symantec • 32 percent of mobile malware discovered over the last 12 months tracks users. • Traditional threats, such as back doors and downloaders are present in 14 percent of all mobile malware threats. • Risks that collect data, such as device info and banking details, make up 15 percent of all risks. • Three new mobile malware families were discovered in January, along with 139 new variants. 32% 15% Track User Collect Data Risks that spy on the individual using the device, collecting SMS messages or phone call logs, tracking GPS coordinates, recording phone calls, or gathering pictures and video taken with the device. This includes the collection of both device- and user-specific data, such as device information, configuration data, or banking details. 15% 14% Send Content Traditional Threats These risks will send text messages to premium SMS numbers, ultimately appearing on the bill of the device’s owner. Other risks can be used to send spam messages. Threats that carry out traditional malware functions, such as back doors and downloaders. 12% 13% Adware/Annoyance Change Settings Mobile risks that display advertising or generally perform actions to disrupt the user. These types of risks attempt to elevate privileges or simply modify various settings within the operating system.
p. 16 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Cumulative Mobile Android Malware Source: Symantec 9000 320 8000 280 7000 240 6000 200 5000 160 4000 120 3000 80 2000 40 1000 F M A M J J A S O FAMILIES N D J 2014 VARIANTS VARIANTS (CUMULATIVE) 10000 360 FAMILIES (CUMULATIVE) 400
p. 17 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 VULNERABILITIES
p. 18 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Vulnerabilities At a Glance Total Vulnerabilities Disclosed by Month Source: Symantec • There were 555 new vulnerabilities discovered in January, bringing the total for the last 12 months to 6443. This is a 17 percent increase over the prior twelve month period. • There were two vulnerabilities in mobile operating systems disclosed during the month of January. • Google’s Chrome browser continues to lead in reporting browser vulnerabilities, while Oracle’s Java leads in reported plug-in vulnerabilities. 800 700 600 500 400 300 200 100 0 F M A M J J A S O Browser Vulnerabilities D Plug-in Vulnerabilities Source: Symantec N Source: Symantec 60% Apple Safari Google Chrome Microsoft Internet Explorer Mozilla Firefox Opera Adobe Acrobat Reader Adobe Flash Player Apple QuickTime Oracle Sun Java 80% 70% 50% 60% 40% 30% 20% 50% 40% 30% 20% 10% 10% J 2014
p. 19 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 SPAM, PHISHING, & MALWARE
p. 20 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Spam At a Glance Top 5 Activity for Spam Destination by Geography Source: Symantec • The global spam rate decreased 1.9 percentage points in January to 62.1 percent, down from 64.0 percent in December. • Mining was the most commonly targeted industry at 64.2 percent, followed by Manufacturing at 63.2 percent. Geography Percent • The .com top-level domain (TLD) was again the most frequently used malicious TLD in January. Sri Lanka 74.7% Israel 68.8% Brazil 66.9% South Africa 65.3% Kuwait 64.8% • Sex Dating spam is the most common category, at 75.2 percent. Pharmaceutical spam came in second at 20.1 percent. Top 5 Activity for Spam Destination by Industry Source: Symantec Industry Percent Mining 64.2% Manufacturing 63.2% Agriculture, forestry & fishing 62.9% Services - Professional 62.1% Construction 62.1%
p. 21 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Top 10 Sources of Spam Top 5 Activity for Spam Destination by Company Size Source: Symantec Source: Symantec Source Percent of All Spam Company Size Percent Canada 7.7% 1-250 62.0% Spain 6.8% 251-500 61.8% Russian Federation 6.4% 501-1000 62.4% United States 5.9% 1001-1500 62.2% Finland 5.6% 1501-2500 62.0% Italy 5.0% 2501+ 62.3% Argentina 4.2% India 3.7% Ukraine 3.2% Romania 3.1% Spam by Category Source: Symantec Category Sex/Dating Month* 0Kb – 5Kb 5Kb – 10Kb >10Kb Dec 28.4% 19.2% 52.3% Nov 37.0% 24.7% 20.1% Jobs Source: Symantec 75.2% Pharma Average Spam Message Size Percent 1.8% Software 0.8% Watches 0.8% 38.4% *Data lags one month Spam URL Distribution Based on Top Level Domain Name Source: Symantec Month* .com .info .ru .biz Dec 33.1% 13.7% 13.2% 10.3% Nov 36.7% 12.4% not listed 9.6% *Data lags one month
p. 22 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Phishing Top 5 Activity for Phishing Destination by Company Size At a Glance Source: Symantec • The global phishing rate is down in January, comprising one in 1 in 1,444 email messages. In December this rate was one in 1 in 1,053. Company Size Rate • Financial themes continue to be the most frequent subject matter, with 67.5 percent of phishing scams containing this theme. 1-250 1 in 1,122 • The South Africa had the highest rate in January, where one in 530 emails was a phishing scam. 251-500 1 in 1,130 • The United States tops the list of sources of phishing emails, responsible for distributing 39.9 percent of phishing scams. 501-1000 1 in 1,463 • Public Administration was the most targeted industry in January, with one in every 761 emails received in this industry being a phishing scam. 1001-1500 1 in 1,563 1501-2500 1 in 1,590 2501+ 1 in 1,865 Top 10 Sources of Phishing Top 5 Activity for Phishing Destination by Industry Source: Symantec Source: Symantec Source Percent Industry Rate United States 39.9% Public Administration 1 in 761 Australia 27.1% Agriculture, forestry & fishing 1 in 874 United Kingdom 24.3% Services - Professional 1 in 1,189 South Africa 2.4% Transportation, communications, electric, gas & Sanitary Services 1 in 1,457.2 Netherlands 1.8% Construction 1 in 1,571.5 Sweden 1.5% Singapore 0.4% Japan 0.3% United Arab Emirates 0.3% New Zealand 0.2% Top 5 Activity for Phishing Destination by Geography Source: Symantec Geography Rate South Africa 1 in 540 United Kingdom 1 in 731 Australia 1 in 821 Austria 1 in 1,183 New Zealand 1 in 1,215
p. 23 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Phishing Distribution Organizations Spoofed in Phishing Attacks Source: Symantec Source: Symantec Organizations Spoofed in Phishing Attacks: Phishing Distribution: Automated Toolkits 58.1% Financial Other Unique Domains 36.3% 67.5% Information Services IP Address Domains 3.2% Free Web Hosting Sites 1.6% Typosquatting 0.7% 29.1% Retail 3.6% Computer Software 0.9% Communications 0.1%
p. 24 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Malware Top 10 Email Virus Sources At a Glance Source: Symantec • The global average virus rate in January was one in 431 emails, compared to one in 164 in December. Geography 15.0% Australia 4.1% Netherlands 2.1% France 1.8% Germany 1.2% Japan 1.2% South Africa 1.1% Canada 0.9% Hong Kong • Organizations with 250-500 employees were the most targeted company size, where one and 383 emails contained a virus. 66.5% United Kingdom • The United States was the largest source of virus-laden emails, making up 66.5 percent of all email-based viruses. Percent United States • Hungary topped the list of geographies, with one in 217 emails containing a virus. 0.7% Proportion of Email Traffic in Which Virus Was Detected Source: Symantec 1 in 0 1 in 50 1 in 100 1 in 150 1 in 200 1 in 250 1 in 300 1 in 350 1 in 400 1 in 450 1 in 500 F M A M J J A S O N D J 2014
p. 25 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Top 5 Activity for Malware Destination by Industry Top 5 Activity for Malware Destination by Geographic Location Source: Symantec Source: Symantec Industry Rate Geography Rate Public Administration 1 in 309 Hungary 1 in 217 Agriculture, forestry & fishing 1 in 332 South Africa 1 in 221 Services - Professional 1 in 343 United Kingdom 1 in 287 Wholesale 1 in 397 Hong Kong 1 in 306 Services - Non Traditional 1 in 467 Ireland 1 in 344 Top 5 Activity for Malware Destination by Company Size Source: Symantec Company Size Rate 1-250 1 in 398 251-500 1 in 383 501-1000 1 in 459 1001-1500 1 in 396 1501-2500 1 in 475 2501+ 1 in 459
p. 26 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Endpoint Security At a Glance Top 10 Most Frequently Blocked Malware Source: Symantec • Variants of W32.Ramnit accounted for 9.4 percent of all malware blocked at the endpoint. • In comparison, 6.1 percent of all malware were variants of W32.Sality. • Approximately 49.5 percent of the most frequently blocked malware last month was identified and blocked using generic detection. Malware Percent W32.Sality.AE 5.4% W32.Ramnit!html 3.8% W32.Almanahe.B!inf 3.4% W32.Downadup.B 3.4% W32.Ramnit.B 3.1% Trojan.Zbot 2.5% W32.Ramnit.B!inf 2.2% W32.SillyFDC 1.7% W32.Virut.CF 1.7% W32.SillyFDC.BDP!lnk 1.0%
p. 27 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 Policy Based Filtering At a Glance Policy Based Filtering Source: Symantec • The most common trigger for policy-based filtering applied by Symantec Web Security .cloud for its business clients was for the “Social Networking” category, which accounted for 51.7 percent of blocked Web activity in January. • “Advertisement & Popups” was the second-most common trigger, comprising 20.5 percent of blocked Web activity. Category Percent Social Networking 51.7% Advertisement & Popups 20.5% Streaming Media 4.3% Hosting Sites 3.2% Computing & Internet 2.8% Chat 1.9% Search 1.5% Gambling 1.0% News 0.9% Entertainment 0.8%
p. 28 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014 About Symantec Symantec protects the world’s information and is a global leader in security, backup, and availability solutions. Our innovative products and services protect people and information in any environment—from the smallest mobile device to the enterprise data center to cloudbased systems. Our world-renowned expertise in protecting data, identities, and interactions gives our customers confidence in a connected world. More information is available at www.symantec.com or by connecting with Symantec at go.symantec.com/socialmedia. More Information • Security Response Publications: http://www.symantec.com/security_response/publications/ • Internet Security Threat Report Resource Page: http://www.symantec.com/threatreport/ • Symantec Security Response: http://www.symantec.com/security_response/ • Norton Threat Explorer: http://us.norton.com/security_response/threatexplorer/ • Norton Cybercrime Index: http://us.norton.com/cybercrimeindex/
Confidence in a connected world. For specific country offices and contact numbers, please visit our website. For product information in the U.S., call toll-free 1 (800) 745 6054. Symantec Corporation World Headquarters 350 Ellis Street Mountain View, CA 94043 USA +1 (650) 527 8000 1 (800) 721 3934 www.symantec.com Copyright © 2014 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.
Presentación que realice en el Evento Nacional de Gobierno Abierto, realizado los ...
In this presentation we will describe our experience developing with a highly dyna...
Presentation to the LITA Forum 7th November 2014 Albuquerque, NM
Un recorrido por los cambios que nos generará el wearabletech en el futuro
Um paralelo entre as novidades & mercado em Wearable Computing e Tecnologias Assis...
Hier sollte eine Beschreibung angezeigt werden, diese Seite lässt dies jedoch nicht zu.
... http://www.symantec.com/content/en/us/enterprise/other_resources/b-intelligence ... b-intelligence_report_01-2014 ... InfoSec Resources ...
Report 01/2014 Submitted: 25.06.2014 Published: 01.07.2014 ... tweida Workshop on Computational Intelligence (MiWoCi 2014) as a satellite event of
The much larger CT960 has a B-axis with direct drive, which swivels from plus 61 degrees to minus 91 ... Intelligence in the sense of linguistic ...
... http://www.symantec.com/content/en/us/enterprise/other_resources/b-intelligence_report ... other_resources/b-intelligence_report_01-2014.en ...
... http://www.symantec.com/content/en/us/enterprise/other_resources/b-intelligence_report_05 ... resources/b-intelligence_report_01-2014.en-us ...
Communicable diseases intelligence quarterly report. 01/2014; 38(4): ... Assoc Prof Stephen B Lambert5 1. Public Health Physician, Central Queensland Public
Madhumati Chatterji · Anne M Baldwin · Rajendra Prakash · Susan A Vlack · Stephen B Lambert [Show ... intelligence quarterly report 01/2014 ...